SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?
⚠ Common exam trap
Candidates often assume VPC peering (Option A) is sufficient for cross-account domain join, but they overlook the need for a trust relationship between Active Directory domains and the complexities of DNS resolution across accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account
AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish VPC peering between the shared services VPC and each developer VPC
Why it's wrong here
Network connectivity alone is insufficient.
- ✗
Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account
Why it's wrong here
Sharing secrets is insecure and not scalable.
- ✗
Use AWS Systems Manager to automate domain join with a custom document
Why it's wrong here
Systems Manager does not handle cross-account authentication natively.
- ✓
Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account
Why this is correct
Trust relationships allow domain join across accounts securely.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.